Wireshark · Ethereal-users: [Ethereal-users] QUES: Out_of_order versus Retransmitted in the TCP Analysis section

["Boeve, Tim" <tim.boeve@xxxxxxxxx>]

The IO Graphs are a powerful extension and have been really helpful in describing network behavior to a larger audience.  Thanks!  I do have a question or two however.

 

In looking through some [client side] traces and particularly the TCP Analysis section, I see few segments marked as ‘retransmitted’ and many more marked as out_of_order.  However, many of the out_of_order segments are retransmitted segments.  I would expect if the segment has been ack’ed earlier it should be marked as retransmitted, but maybe there is a hierarchy of analysis that should be described to allow for more clarity during analysis.

 

Also, a few of the expressions, for example ‘tcp.analysis.fast_retransmission’ do not fit in the IO Graph _expression_ field and hence cannot be plotted.

 

Tim Boeve